To be specific, let me propose the following:
rfc3489bis: says the username MUST be less than 513 bytes. It also says
that the STUN message when sent over UDP MUST be less than the MTU.
ICE: says that the username fragment MUST be less than 256 bytes.
The desire for the ability to have larger usernames is not security
(i.e., this doesn't mean endpoints compute username fragments with 256
bytes of entropy), but that cases have been identified ala Dan's draft
of stuffing useful identifiers in there. So we want to allow that to be
possible in the future. Length limits always need to be carefully
managed, since they are nice in terms of implementation but you can
sometimes regret them in a really big way down the road (think SMS
message sizes, 640k memory limit, etc.)